Go to Top

Does Siri Have Loose Lips? eDiscovery Implications of Apple’s Cell Phone Voice Recognition Software

IBM lets employees use iPhones on-site, but bans the use of Siri, Apple’s new voice recognition and processing software, over privacy and data collection fears.

http://www.wired.com/wiredenterprise/2012/05/ibm-bans-siri/

The Background

Apple’s newest iPhone model comes packaged with groundbreaking voice recognition technology called “Siri.”  Siri operates like a virtual assistant, translating users’ spoken inquiries into digital commands and searches.  However, Siri does not operate locally on the iPhone, instead sending users’ inquiries to a data center in Maiden, North Carolina for translating and processing.  Apple’s iPhone Software License Agreement explains, “By using Siri… you agree and consent to Apple’s and its subsidiaries’ and agents’ transmission, collection, maintenance, processing, and use of this information, including your voice input and User Data…”  IBM has banned employees’ on-site use of Siri, and the ACLU has warned of the privacy implications of Apple’s data collection.

The Rules

From an e-discovery standpoint, Siri-stored ESI appears to fit within the disclosure guidelines established by the Federal Rules of Civil Procedure.  Rule 26(a) establishes “electronically stored information” (ESI) as its own evidentiary category, and Rules 16, 26, 33, 34, 37, and 45 require attorneys pay comply with strict e-discovery issues.  The Sedona Conference has indicated digital voicemail recordings will soon become standard targets of e-discovery, focusing on Rule 34(a)(1)(A)’s specific designation of “sound recordings” as discoverable media.  Parties would therefore be required to begin preserving and collecting evidence whenever litigation was “reasonably anticipated” or risk spoliation sanctions.

The Precedent

Where digital voice recordings are stored locally, courts have required parties to comply with traditional e-discovery obligations established by case law, like Zubalake, and the Federal Rules of Civil Procedure.  See, e.g., E*Trade Secs. LLC v. Deutsche Bank AG, 230 F.R.D. 582 (D. Minn. 2005) (sanctioning defendants for spoliation where digital recordings of broker/trader phone conversations were recorded on rewritable DVDs, but then recorded over as new calls were completed); In Re: Seroquel Products Liability Litigation, 244 F.R.D. 650 (M.D. Fl. 2007) (sanctioning defendants for, in part, failing to produce voicemails delivered through the company’s unified Outlook inbox system).  Siri’s remotely stored data, however, is likely federally protected by the Stored Communications Act (the “SCA”).  The SCA creates Fourth Amendment-like privacy protections for information digitally transmitted over the Internet, and a court order would be required for Apple to produce the information.  For digital communication held “solely for the purpose of providing storage or computer processing services,” a search warrant, subpoena, or 2703(d) order (usually combined with “prior notice”) is required to compel production.  Nonetheless, “non-content” information, like log data or names and email addresses of recipients, may be shared with third parties without an order.

The Take-Aways

  1. Be careful what you tell your iPhone.  Siri queries are preserved and likely discoverable (with a court order).
  2. It’s unclear how long, and in what form, Apple stores Siri-generated data.  Parties may be required to preserve and collect “non-content” Siri information (information that can be released under the SCA without a court order) when litigation is “reasonably anticipated” or risk spoliation sanctions.
, , , , , , , , , , , , ,

About Jeff Hartman

Jeff is a 30 year veteran of the corporate security, computer forensics, and eDiscovery community and a co-founder and partner at 4Discovery. 4Discovery is a leading provider of computer incident response and computer forensics services to attorneys, corporate security executives, and the information protection community.